What Is Claimed Is : 



1 . A method for monitoring a plurality of control units in a network, comprising the steps of 
providing to each control unit a secxirity function for detecting a plurality of errors; 
assigning a monitoring routine selected from a plurality of monitoring routines to each 

error; 

assigning a shutdown matrix that is subdivided according to the plurality of errors to 
the security function; 

selecting at least one of the pliurality of monitoring routines according to the errors 
present in the shutdown matrix, wherein: 

depending on at least one first condition, the shutdown matrix contains 
a plurality of shutdown strategies; and 

on detection of at least one of the plurality of errors by one of the plurality of 
^ monitoring routines and depending on at least one of the at least one first condition and at 
least one second condition, performing one of the plurality of shutdown strategies in the 
network to shut down at least one of the plurality of control units. 
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2. The method according to claim 1, wherein at least one of the at least one first condition and 
the at least one second condition corresponds to at least one of: 

an error detection, 

an error description, 

an operating mode, 

an operating state, 

a control unit for shutdown strategy, 

a control unit for monitoring routine, 

an error detection time, and 

one of a use tolerance and use limit. 



3. The method according to claim 1, further comprising the step of: 

subdividing the security function into at least subfimctions relating to a security core, 
the plxirality of monitoring routines, and the plurality of shutdown strategies, the security core 
being the same on all the control units of the network. 
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4. The method according to claim 3, wherein the security function additionally includes at 
least one of: 

an initialization, 
an error entry, and 
a restore testing. 

5. The method according to claim 1, further comprising the step of: 

providing to one of the plurality of control units of the network a coordinating 
function for all other control units in the plurality of control units with respect to at least one 
of an initialization subfunction, an error entry subfimction, and a restore testing subfimction 
contained in the security function of the control unit provided with the coordinating function. 

6. The method according to claim 1 , wherein: 

those of the plurality of monitoring routines which can be selected by each 
control unit are different for each control unit according to the errors that can be 
detected as well as the respective shutdown matrices of the control units, and 

the monitoring and the shutdown strategies are distributed among all the 
control units of the network. 

7. The method according to claim 1, wherein: 

those of the monitoring routines which can be selected by each control unit are 
one of the same and partially the same for each control unit according to the errors 
that can be detected as well as the respective shutdown matrices of the control units, 

and 

the monitoring and the shutdown strategies are one of redmdant and capable 
of being carried out in a partially redundant manner. 

8. A device for monitoring a plurality of control units in a network, comprising: 

an arrangement for providing to each control unit a security function for detecting a 
plurality of errors; 

an arrangement for assigning a monitoring routine selected from a plurality of 
monitoring routines to each error; 

an arrangement for assigning a shutdown matrix that is subdivided according to the 
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plurality of errors to the security function; 

an arrangement for selecting at least one of the plurality of monitoring routines 
according to the errors present in the shutdown matrix, wherein: 

depending on at least one first condition, the shutdown matrix contains 

a plurality of shutdown strategies; and 

an arrangement for, on detection of at least one of the plurality of error by one of the 
pluraUty of monitoring routine and depending on at least one of the at least one first 
condition and at least one second condition, performing one of the plurality of shutdown 
strategies in the network to shut down at least one of the plurality of control units. 

9. A network, comprising: 

a plurality of control units, each control unit including: 

an arrangement for providing to each control unit a security fimction for 
detecting a plurality of errors; 

an arrangement for assigning a monitoring routine selected firom a plurality of 
monitoring routines to each error; 

an arrangement for assigning a shutdown matrix that is subdivided according 
to the plurality of errors to the security fimction; 

an arrangement for selecting at least one of the plurality of monitoring routines 
according to the errors present in the shutdown matrix, wherein: 

depending on at least one first condition, the shutdown matrix contains 

a plurality of shutdown strategies; and 

an arrangement for, on detection of at least one of the plurality of error by one 
of the plurality of monitoring routine and depending on at least one of the at least one 
first condition and at least one second condition, performing one of the plurality of 
shutdown strategies in the network to shut down at least one of the plurality of control 
units. 

10. A program for causing at least one control unit of a network to perform the steps of: 

providing to each control unit a security function for detecting a plurality of errors; 
assigning a monitoring routine selected firom a plurality of monitoring routines to each 

error; 

assigning a shutdown matrix that is subdivided according to the plurality of errors to 
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the security function; 

selecting at least one of the plurality of monitoring routines according to the errors 
present in the shutdown matrix, wherein: 

depending on at least one first condition, the shutdown matrix contains 

a plurality of shutdown strategies; and 

on detection of at least one of the plurality of error by one of the plurality of 
monitoring routine and depending on at least one of the at least one first condition and at least 
one second condition, performing one of the plurality of shutdown strategies in the network 
to shut down at least one of the plurality of control units. 
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